PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA
pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)
Digital Platform “SMALLDERS”
1. Introduction
This privacy notice describes the methods of processing personal data carried out through the
digital platform SMALLDERS.
The processing of personal data is carried out in compliance with Regulation (EU) 2016/679
(“GDPR”), applicable national legislation in the Member States involved, and the principles of
lawfulness, fairness, transparency, and data integrity.
2. Data Controllers
Considering the transnational dimension of the project, each institutional partner operates as
an independent Data Controller for processing activities carried out within its own national
territory.
The Data Controllers are:
- University of Extremadura – Spain
- IMT Mines Alès – France
- University of Tunis El Manar – Tunisia
- University of Parma – Italy
- University of Calabria – Italy
For activities jointly carried out in Italy, the above-mentioned Universities operate as
independent Data Controllers or Joint Controllers pursuant to Article 26 GDPR, according to
internal agreements defining their respective responsibilities.
Any providers of technological or logistical services processing data on behalf of the Data
Controllers are appointed as Data Processors pursuant to Article 28 GDPR.
3. Categories of Data Subjects
- Citizens;
- Small agricultural producers;
- Critical stakeholders;
- Freight transport companies;
- Policy makers.
4. Purposes of Processing
- registration, authentication, and management of user accounts;
- management of agricultural traceability throughout the entire supply chain;
- recording of relevant information on blockchain infrastructure;
- management of e-commerce transactions between small agricultural producers and citizens;
- management of logistics and shipments through Freight Transport Companies;
- compliance with regulatory obligations;
- fraud prevention and protection of the rights of the Data Controllers;
- statistical analysis and improvement of the platform.
5. Legal Basis for Processing
- Art. 6(1)(b) GDPR – performance of a contract;
- Art. 6(1)(c) GDPR – compliance with legal obligations;
- Art. 6(1)(f) GDPR – legitimate interest;
- Art. 6(1)(a) GDPR – consent of the data subject, where required.
6. Categories of Data Processed
Identification data: name, surname, email, telephone number, address.
Professional/agricultural data: company information, certifications, cultivation data.
Transactional data: orders, shipments, payments (through certified providers).
Technical data: IP address, access logs, browsing data.
7. Use of Blockchain Technology
The SMALLDERS platform uses blockchain technology to ensure integrity, transparency, and
immutability of information relating to the agricultural supply chain.
The personal data recorded are limited to what is strictly necessary and, where possible,
pseudonymized through cryptographic techniques.
8. Security Measures
- data encryption (HTTPS/TLS);
- role-based authentication;
- access control;
- monitoring and auditing.
9. Data Recipients
Personal data may be disclosed to project partners, technology providers, payment service
providers, logistics operators, and competent public authorities within the limits established
by law.
10. International Transfers
Any transfers to third countries will take place in compliance with Articles 44 et seq. GDPR,
through appropriate legal safeguards.
11. Data Retention Period
Personal data are retained for the period strictly necessary to achieve the indicated purposes
and in accordance with applicable regulatory obligations. Data recorded on blockchain are not
modifiable due to their technical nature, but may be pseudonymized or anonymized where
necessary.
12. Rights of the Data Subject
Data subjects may exercise the rights provided for in Articles 15–22 GDPR: access,
rectification, erasure, restriction, data portability, objection, and lodging a complaint with
the competent Supervisory Authority.
